Tailscale Premium: Users generating traffic from multiple devices

Identifies users (SrcUser) generating tailnet flows from more than one distinct device in the past 24 hours. Useful for spotting account compromise (sudden new device) or unauthorised device enrollment.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: tailscalepremiumccf
Log source service: tailscale_devices_cl tailscale_network_cl

Detection rules

Tailscale Premium: Users generating traffic from multiple devices

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules